Account

Set a member module access level

Replace the FULL set of module restrictions of a member in the tax ID named by company_id, and optionally its grants.

  • The body replaces every previous restriction; an empty restrictions lifts them all. Sent grants replace the old ones.
  • 422 business_rule_violation for restricting yourself, the owner or an unrestrictable section; 404 member_not_found. Requires the members:write scope, which * does not cover: the API key must list it explicitly.
patch/accounts/{account}/members/{member}/module-access

Request

  • Base URL: https://api.factuarea.com/v1
  • URL: https://api.factuarea.com/v1/accounts/{account}/members/{member}/module-access
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Path parameters

accountstring uuid required

Public identifier (UUID v7) of your account. Get it from GET /v1/me (data.account.id).

memberstring uuid required

Public identifier (UUID v7) of the account member.

Headers

Idempotency-Keystring
Example:01928f10-7c0e-7c4a-9b7d-2f8a6e3c1d4b

Client-generated opaque key (up to 255 characters; UUID v7 recommended) that makes retries safe: the first response is cached and replayed for repeats without re-executing the mutation. Reusing a key with a different body returns 422 idempotency_key_reused; the values of secret fields (password, secret…) count as part of the body, so retrying with a corrected secret under the same key is a different request, never the replay of the earlier answer. See the Idempotency guide.

Factuarea-Versionstring date
Example:2026-06-01

Pin the API version (YYYY-MM-DD, Stripe-style date versioning) for this request; omit to use the key's pinned version, or the latest if none. Unsupported version → 400 unsupported_api_version; malformed → 400 parameter_invalid_format. The effective version is echoed in the Factuarea-Version response header. See the Versioning guide.

Request body

company_idstring uuid required

Public identifier (UUID v7) of the company the access level is set on.

grantsstring[]

Administrator-only sections GRANTED to the member in that tax ID (for example verifactu); never the Administrator keys (user management, plan and subscription, API and developers, digital certificate). Optional: omitted, the grants are left as they are; sent — even empty — it replaces them entirely.

Response

Example response

{
  "data": {
    "restrictions": {},
    "grants": []
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.